AFRL-AFO  SR- VA-TR- 2015- 0340 


QUANTIFYING  TRUST,  DISTRUST,  AND  SUSPICION  IN  HUMAN-SYSTEM  INTERACTIONS 


StuartHirshfield 
HAMILTON  COLLEGE 


10/26/2015 
Final  Report 


DISTRIBUTION  A:  Distribution  approved  for  public  lelease. 


Air  Force  Research  Laboratory 
AF  Office  Of  Scientific  Research  (AFOSR)/  RTA2 
Arlington,  Virginia  22203 
Air  Force  Materiel  Command 


REPORT  DOCUMENTATION  PAGE 


Form  Approved 
OMB  No.  0704-0188 


The  public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information,  including 
suggestions  for  reducing  the  burden,  to  the  Department  of  Defense,  Executive  Service  Directorate  (0704-0188).  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no 
person  shall  be  subject  to  any  penalty  for  failing  to  comply  with  a  collection  of  information  if  it  does  not  display  a  currently  valid  OMB  control  number. 

PLEASE  DO  NOT  RETURN  YOUR  FORM  TO  THE  ABOVE  ORGANIZATION. 


1.  REPORT  DATE  (DD-MM-YYYY)  2.  REPORT  TYPE 

08-10-2015  final  report 


4.  TITLE  AND  SUBTITLE 

Quantifying  Trust,  Distrust,  and  Suspicion  in  Human-System  Interactions 


3.  DATES  COVERED  (From  -  To) 

July  15,  2011- July  14,  2014 


5a.  CONTRACT  NUMBER 


5b.  GRANT  NUMBER 

FA9550-1 1-1-01 12 


5c.  PROGRAM  ELEMENT  NUMBER 


6.  AUTHOR(S) 

Stuart  Hirshfield 
Hamilton  College 


5d.  PROJECT  NUMBER 


5e.  TASK  NUMBER 


Leanne  Hirshfield 
Syracuse  University 


7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

Hamilton  College-  198  College  Hill  Rd.  Clinton  NY  13323 
Syracuse  University-  215  University  Place,  Syracuse  NY  13244 


5f.  WORK  UNIT  NUMBER 


8.  PERFORMING  ORGANIZATION 
REPORT  NUMBER 


9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES) 

Air  Force  Office  of  Scientific  Research 


10.  SPONSOR/MONITOR'S  ACRONYM(S) 


1 1 .  SPONSOR/MONITOR'S  REPORT 
NUMBER(S) 


12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release,  distribution  unlimited  Distribution  A 


14.  ABSTRACT 

In  this  research  effort  we  used  our  new  usability  lab  containing  a  state-of-the  art  suite  of  cognitive,  physiological,  and  behavioral  measurement 
devices  to  isolate  and  quantify  the  various  low  level  variables  that  indicate  the  level  of  trust  that  is  present  while  a  person  works  with  his  or  her 
computer  system.  Recent  advances  in  Biomedical  Engineering  have  resulted  in  the  development  of  extremely  non-invasive  brain  measurement 
devices.  These  devices  hold  great  potential  for  the  quantitative,  real-time  measurement  of  user  states  during  realistic  human-computer  interactions. 
This  research  effort  built  upon  our  previous  research;  where  we  developed  techniques  to  enhance  usability  testing  with  functional  near  infrared 
spectroscopy  (fNIRS)  and  Electroencephalography  (EEG).  Our  primary  goal  was  to  apply  our  research  to  the  AFOSR  Denial  &  Disrupt  project, 
measuring  the  effects  of  various  interface  disruptions  on  users’  cognitive  workload. 

In  this  effort,  we  continued  our  research  with  non-invasive  brain  measurement  and  explored  the  quantitative  measurement  of  trust,  distrust,  and 
suspicion  while  a  user  works  with  his  or  her  computer  system.  This  timely  research  holds  great  potential  in  the  cyber-operations  domain,  where  we 


15.  SUBJECT  TERMS 

Quantifying  Trust,  Distrust,  and  Suspicion  in  Human-System  Interactions 


16.  SECURITY  CLASSIFICATION  OF: 

a.  REPORT 

b.  ABSTRACT 

c.  THIS  PAGE 

u 

u 

u 

17.  LIMITATION  OF  18.  NUMBER  |19a.  NAME  OF  RESPONSIBLE  PERSON 


ABSTRACT 


OF 

PAGES 


19b.  TELEPHONE  NUMBER  (Include  area  code) 


DISTRIBUTION  A:  Distribution  approved  for  public  releat 


Standard  Form  298  (Rev.  8/98) 

Prescribed  by  ANSI  Std.  Z39.18 
Adobe  Professional  7.0 


INSTRUCTIONS  FOR  COMPLETING  SF  298 


1.  REPORT  DATE.  Full  publication  date,  including 
day,  month,  if  available.  Must  cite  at  least  the  year  and 
be  Year  2000  compliant,  e.g.  30-06-1998;  xx-06-1998; 
xx-xx-1998. 

2.  REPORT  TYPE.  State  the  type  of  report,  such  as 
final,  technical,  interim,  memorandum,  master's  thesis, 
progress,  quarterly,  research,  special,  group  study,  etc. 

3.  DATES  COVERED.  Indicate  the  time  during  which 
the  work  was  performed  and  the  report  was  written, 
e.g.,  Jun  1997  -  Jun  1998;  1-10  Jun  1996;  May-  Nov 
1998;  Nov  1998. 

4.  TITLE.  Enter  title  and  subtitle  with  volume  number 
and  part  number,  if  applicable.  On  classified 
documents,  enter  the  title  classification  in  parentheses. 

5a.  CONTRACT  NUMBER.  Enter  all  contract  numbers 
as  they  appear  in  the  report,  e.g.  F33615-86-C-5169. 

5b.  GRANT  NUMBER.  Enter  all  grant  numbers  as 
they  appear  in  the  report,  e.g.  AFOSR-82-1234. 

5c.  PROGRAM  ELEMENT  NUMBER.  Enter  all 
program  element  numbers  as  they  appear  in  the  report, 
e.g.  61 101  A. 

5d.  PROJECT  NUMBER.  Enter  all  project  numbers  as 
they  appear  in  the  report,  e.g.  1F665702D1257;  ILIR. 

5e.  TASK  NUMBER.  Enter  all  task  numbers  as  they 
appear  in  the  report,  e.g.  05;  RF0330201;  T4112. 

5f.  WORK  UNIT  NUMBER.  Enter  all  work  unit 
numbers  as  they  appear  in  the  report,  e.g.  001; 
AFAPL30480105. 

6.  AUTHOR(S).  Enter  name(s)  of  person(s) 
responsible  for  writing  the  report,  performing  the 
research,  or  credited  with  the  content  of  the  report.  The 
form  of  entry  is  the  last  name,  first  name,  middle  initial, 
and  additional  qualifiers  separated  by  commas,  e.g. 
Smith,  Richard,  J,  Jr. 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND 
ADDRESS(ES).  Self-explanatory. 


8.  PERFORMING  ORGANIZATION  REPORT  NUMBER. 

Enter  all  unique  alphanumeric  report  numbers  assigned  by 
the  performing  organization,  e.g.  BRL-1234; 
AFWL-TR-85-401 7-Vol-2 1  -PT-2. 

9.  SPONSORING/MONITORING  AGENCY  NAME(S) 
AND  ADDRESS(ES).  Enter  the  name  and  address  of  the 
organization(s)  financially  responsible  for  and  monitoring 
the  work. 

10.  SPONSOR/MONITOR'S  ACRONYM(S).  Enter,  if 
available,  e.g.  BRL,  ARDEC,  NADC. 

11.  SPONSOR/MONITOR'S  REPORT  NUMBER(S). 

Enter  report  number  as  assigned  by  the  sponsoring/ 
monitoring  agency,  if  available,  e.g.  BRL-TR-829;  -215. 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT.  Use 

agency-mandated  availability  statements  to  indicate  the 
public  availability  or  distribution  limitations  of  the  report.  If 
additional  limitations/  restrictions  or  special  markings  are 
indicated,  follow  agency  authorization  procedures,  e.g. 
RD/FRD,  PROPIN,  ITAR,  etc.  Include  copyright 
information. 

13.  SUPPLEMENTARY  NOTES.  Enter  information  not 
included  elsewhere  such  as:  prepared  in  cooperation 
with;  translation  of;  report  supersedes;  old  edition  number, 
etc. 

14.  ABSTRACT.  A  brief  (approximately  200  words) 
factual  summary  of  the  most  significant  information. 

15.  SUBJECT  TERMS.  Key  words  or  phrases  identifying 
major  concepts  in  the  report. 

16.  SECURITY  CLASSIFICATION.  Enter  security 
classification  in  accordance  with  security  classification 
regulations,  e.g.  U,  C,  S,  etc.  If  this  form  contains 
classified  information,  stamp  classification  level  on  the  top 
and  bottom  of  this  page. 

17.  LIMITATION  OF  ABSTRACT.  This  block  must  be 
completed  to  assign  a  distribution  limitation  to  the  abstract. 
Enter  UU  (Unclassified  Unlimited)  or  SAR  (Same  as 
Report).  An  entry  in  this  block  is  necessary  if  the  abstract 
is  to  be  limited. 


DISTRIBUTION  A:  Distribution  approved  for  public  release 


Standard  Form  298  Back  (Rev.  8/98) 


Quantifying  Trust,  Distrust,  and  Suspicion  in  Human-System  Interactions 

PI:  Stuart  Hirsh  Held,  Co-PI  Dr.  Leanne  Hirshfield1 
Computer  Science  Department 
Hamilton  College 
Clinton,  NY  13323 
shirshfi@syr.edu 


Overview 

With  specialties  in  HCI  and  machine  learning,  our  research  explores  the  use  of  non-invasive  brain 
and  physiological  sensor  measurement  to  classify  user  states  passively  in  order  to  enhance  usability 
testing  and  adaptive  system  design.  We  have  a  strong  record  of  accomplishment  in  applying  our 
non-invasive  physiological  sensor  research  to  avenues  of  research  in  the  cyber  domain. 

Lab  at  Syracuse  University 

With  support  from  the  AFOSR  DURIP  program,  we  run  a  state-of-the-art  HCI  lab.  The  lab 
contains  over  $500K  of  non-invasive  cognitive,  physiological,  and  behavioral  measurement 
devices.  This  includes  a  52-channel  functional  near-infrared  spectroscopy  ( (NIRS)  device  from 
Hitachi  Medical  (ETG  4000),  Advanced  Brain  Monitoring’s  b-alert  wireless  EEG,  a  desk  mounted 
faceLab  eyetracker,  two  wireless  galvanic  skin  response  sensors  from  Affectiva,  faceReader 
emotion  recognition  software,  Morae  usability  testing  software,  and  several  computer  workstations 
for  use  in  experiments. 

With  their  potential  to  monitor  people’s  mental  states  non-invasively  and  in  real-time, 
Electroencephalography  (EEG)  and  functional  near-infrared  spectroscopy  (fNIRS)  have  become 
popular  brain  imaging  techniques,  and  have  been  used  by  researchers  to  measure  a  wide  range  of 
cognitive  and  emotional  states  in  operational  settings  [1-13].  Electroencephalography  (EEG)  and 
functional  near-infrared  spectroscopy  (fNIRS)  are  popular,  non-invasive,  brain  imaging 
techniques.  Unlike  other  brain  devices  which  require  subjects  to  he  in  restricted  positions  (fMRI), 
or  to  drink  hazardous  materials  (PET),  EEG  and  fNIRS  can  non-invasively  measure  users’  brain 
activity  under  normal  working  conditions  [1].  This  makes  EEG  and  fNIRs  appropriate  choices  for 
brain  measurement  in  HCI.  EEG  and  fNIRS  measure  different  physiological  responses  to  mental 
state  changes.  EEG  measures  the  electrical  potentials  caused  by  neurons  firing  during  brain 
activity.  fNIRS  measures  blood  volume  and  oxygenation  changes,  reflecting  hemodynamic 
responses  to  brain  activity.  The  majority  of  brain  measurement  research  in  HCI  uses  EEG  to 
measure  users’  states  while  a  smaller  body  of  research  uses  fNIRS.  fNIRS  is  the  only  non-invasive 
device  that  can  be  used  in  operational  setting  that  provides  us  with  functional  localizations 
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comparable  to  fMRI.  Since  fNIRS  and  fMRI  both  measure  elements  of  the  Blood  Oxygen  Level 
Dependent  (BOLD)  signal.  Researchers  have  recently  explored  the  combination  of  the  two  devices 
to  measure  brain  function  [2-5].  This  is  promising,  as  combining  the  two  devices  can  provide 
information  about  both  the  neural  activations  and  the  subsequent  oxygenation  and  blood  flow 
changes  in  the  brain.  Furthermore,  by  pairing  the  low  spatial  and  high  temporal  resolution  of  EEG 
with  the  high  spatial  and  low  temporal  resolution  of  fNIRs,  it  may  be  possible  to  overcome 
limitations  of  each  measurement  technology. 

Our  high  density  52-channel  fNIRS  has  head  probe  configurations  that  enable  brain  measurement 
across  the  entire  head,  rather  than  being  limited  to  the  forehead  (Figure  1). 


Figure  1:  The  ETG4000  52-channel  fNIRS  at  Newhouse, 

Furthermore,  the  high  spatial  resolution  of  our  fNIRS  enables  us  to  study  functional  brain  regions 
that  contribute  to  information  processing.  For  example,  we  have  used  fNIRS  to  differentiate 
between  verbal  search  load,  response  inhibition  load,  verbal  working  memory  load,  and  spatial 
working  memory  load  [1,  7].  We  have  also  successfully  localized  brain  regions  such  as  the 
dorsolateral  prefrontal  cortex  as  it  relates  to  emotion  regulation,  the  paracingulate  cortex  as  it 
relates  to  suspicion,  and  Broca’s  area  as  it  relates  to  highly  alarming  and  stressful  situations  [14]. 
These  findings  are  expanded  upon  next.  As  an  example  of  the  high  spatial  resolution  afforded  by 
the  fNIRS  device,  Figure  2  depicts  the  results  of  statistical  tests  using  fNIRS  and  fMRI  when 
subjects  viewed  the  same  stimulus  [15]. 
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Figure  2:  Example  showing  the  statistical  test  results  of  a  particular  stimulus  on  one 

subject  [15]. 


Our  Prior  Related  Work  (2007-2010) 

Dr.  Leanne  Hirsh  field  has  established  a  portfolio  of  work  in  the  cyber  domain.  Since  beginning 

work  with  AFOSR  as  a  PhD  student  in  2007,  her  research  has  focused  on: 

1)  Using  fNIRS  to  accurately  measure  cognitive  load  in  real  time  during  usability  studies.  One 
end  goal  of  this  research  was  to  conduct  usability  studies  with  fNIRS  to  measure  the  workload 
of  select  D5  techniques  on  unsuspecting  computer  users  [1,7,  16-19]. 

2)  Defining  the  construct  of  suspicion  as  it  relates  to  the  IT  (information  technology) 
environment[20] . 

3)  Using  a  suite  of  non-invasive  sensors  to  measure  correlates  relating  to  trust,  distrust,  and 
suspicion  in  computer  users  working  in  the  IT  domain  [6,  14,  21]. 


Dr.  Hirshfield’s  earliest  AFOSR  6.1  research  began  in  2007  while  she  was  a  graduate  student  at 
Tufts  University  as  part  of  the  AFOSR  Denial  and  Disrupt  (D&D)  project.  Much  has  changed  in 
the  cyber  landscape  since  2007.  The  D&D  project  aimed  to  take  an  offensive  stance  toward 
adversarial  computer  operators  in  cyberspace.  At  the  time,  cyber-operations  techniques  had  been 
developed  by  personnel  at  Assured  Information  Security  (AIS)  to  monitor  or  disrupt  an  adversarial 
operator’s  computer.  By  introducing  subtle  -  and  hopefully  undetectable  -  disruptions  into  an 
adversary’s  computer  system,  the  D&D  project  aimed  to  increase  user  workload,  cause 
distractions,  and  increase  user  error  rates. 

Some  examples  of  disruptions  are  disabling  copy  and  paste  functionality,  changing  the  effects  of 
pressing  various  keyboard  keys,  causing  pop-ups  to  appear  on  the  screen,  and  slowing  down 
program  response  time.  By  introducing  these  subtle  disruptions  into  an  adversary’s  computer 
system  the  D&D  project  aimed  to  continually  reduce  the  adversary’s  threat  potential  while 
monitoring  his  actions.  Understanding  the  effects  that  sequences  of  disruptions  have  on  operators 
was  essential  to  the  success  of  the  D&D  project.  Fundamental  questions  stemming  from  the  D&D 
project  were: 
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•  How  do  we  measure  the  effectiveness  of  various  interface  disruptions? 

•  What  kinds  of  disruptions  should  we  choose  when: 

o  We  want  to  increase  a  computer  operator’s  error  rate? 
o  We  want  to  make  a  computer  operator  less  efficient? 
o  We  want  to  overload  or  distract  a  computer  operator? 

•  What  human  performance  characteristics  do  we  measure? 

•  How  do  we  conduct  usability  experiments  to  acquire  the  necessary  metrics? 

Ideally,  these  usability  tests  could  be  conducted  to  evaluate  the  effects  of  the  D&D  disruptions  on 
computer  users.  While  usability  tests  can  acquire  objective,  real-time  metrics  of  a  user’s  speed  and 
accuracy  while  working  with  an  interface,  acquiring  additional  metrics  about  the  user’s  workload 
while  working  with  a  computer  system  involved  the  use  of  surveys.  These  surveys  are  highly 
subjective,  are  often  prone  to  subject  biases,  and  are  administered  after  a  task  has  been  completed, 
lacking  valuable  insight  into  the  user’s  changing  experiences  during  a  task. 

The  novelty  of  our  original  AFOSR  6.1  research  stemmed  from  the  use  of  fNIRS  to  measure  and 
quantify  cognitive  load.  We  developed  machine  learning  techniques  that  enabled  us  to  predict 
workload  on  a  single  trial  basis,  while  users  completed  computer  tasks.  We  were  then  able  to 
measure  accurately  the  effect  that  certain  D5  techniques  had  on  the  cognitive  load  of  computer 
users.  In  particular,  we  examined  cognitive  load,  overload,  and  distraction  as  effected  by  pop-ups, 
dropped  keystrokes,  switched  keystrokes. 

Through  our  work  conducting  this  initial  6.1  research  project,  we  were  among  the  first  to  pair 
fNIRS  data  with  machine  learning  techniques,  and  among  the  first  researchers  to  demonstrate  the 
potential  of  fNIRS  as  a  non-invasive  technique  for  the  real-time  assessment  of  cognitive  load  for 
usability  tests  and  adaptive  systems.  We  enhanced  usability  testing  and  the  measurement  of  user 
states  in  general,  and  more  specifically,  we  applied  the  findings  from  our  basic  research  to  the 
usability  testing  problems  stemming  from  the  Denial  &  Disrupt  project  [1,7,  16,  17,  19,  21]. 


Accomplishments  of  this  Research  Project  (2011  -  2014) 

The  research  described  in  this  final  report  was  a  follow-up  effort  to  the  research  described  above. 
While  conducting  the  initial  D&D  research  on  cognitive  load,  the  critical  notion  of  ‘suspicion’ 
emerged.  It  was  obvious  that  a  disruption  was  only  useful  if  it  did  not  cause  suspicion  in  adversarial 
operators.  From  the  defensive  point  of  view,  it  was  also  apparent  that  many  complacent  workers 
would  have  an  initial  onset  of  suspicion  when  they  noticed  something  amiss  with  the  computer, 
but  they  would  never  end  up  becoming  suspicious  (this  would  result  in  a  successful  cyber  attack 
occurring  on  blue  forces  in  the  operational  domain).  Dr.  Hirshfield  worked  with  Dr.  Phil  Bobko 
and  Lt.  Col.  Alex  Barelka  to  better  understand  the  role  of  suspicion  in  the  IT  domain.  It  was  clear 
from  the  start  that  the  construct  of  suspicion  was  poorly  defined  in  the  literature,  and  that  the  scant 
literature  that  described  manipulations  of  suspicion  in  experimental  settings  was  of  variable 
quality. 

The  result  of  this  exploration  into  the  suspicion  domain  was  a  recent  Human  Factors  publication 
[20].  In  that  publication,  studies  that  consider  suspicion  were  reviewed  and  integrated.  These 
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interdisciplinary  literature  areas  included  communication,  psychology,  human  factors, 
management,  marketing,  information  technology,  and  brain/neurology.  We  first  developed  a 
generic  model  of  state-level  suspicion.  Research  propositions  were  then  derived  within  IT 
contexts.  Our  findings  indicated  that  fundamental  components  of  suspicion  include  (i)  uncertainty, 
(ii)  increased  cognitive  processing  (e.g.,  generation  of  alternative  explanations  for  perceived 
discrepancies),  and  (iii)  perceptions  of  (mal)intent.  We  therefore  defined  “state  suspicion”  as  the 
simultaneous  occurrence  of  these  three  components.  Our  analysis  also  suggested  that  trust  inhibits 
suspicion,  while  distrust  can  be  a  catalyst  of  state-level  suspicion.  Based  on  a  three-stage  model  of 
state-level  suspicion  (Figure  3),  associated  research  propositions  and  questions  were  developed. 
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Figure  3:  Our  three  stage  model  of  suspicion  [20], 


These  propositions  and  questions  were  intended  to  help  guide  future  work  on  the  measurement  of 
suspicion  (self-report  and  neurological),  as  well  as  the  role  of  the  construct  of  suspicion  in  models 
of  decision-making  and  detection  of  deception[20]. 


In  addition  to  the  theoretically-based  work  on  suspicion  and  trust  described  above,  Dr.  Hirshfield 
has  remained  focused  on  the  use  of  machine  learning  methods  to  accurately  predict  mental  states 
that  are  of  particular  interest  in  the  cyber  domain  using  physiological  (fNIRS,  EEG,  eyetracking, 
and  GSR)  and  behavioral  (keypress  and  mouse  movement)  sensors.  A  practical  -  and  generally 
useful  -  byproduct  of  these  experiments  and  research  was  the  development  of  custom  machine 
learning  algorithms  that  predict  mental  states  with  cognitive,  physiological,  and  behavioral  data 
[1,6,  17,  28].  Unlike  traditional  statistical  techniques  (which  complement  the  results  of  machine 
learning),  accurate  machine  learning  classifiers  are  essential  in  order  to  predict  the  presence,  or 
effects,  of  cyber  techniques  in  real-time  on  blue  and  red  force  cyber  operators. 


Model  of  the  Physiological  Correlates  of  Trust,  Distrust,  and  Suspicion 
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Another  valuable  result  from  Dr.  Hirshfield’s  AFOSR  research  is  a  model  describing  the 
physiological  correlates  of  trust,  distrust,  and  suspicion  (Figure  4).  The  model  is  grounded  in  the 
theoretical  suspicion  and  trust  work  done  by  Bobko,  Barelka  and  Hirshfield  [20],  and  it  combines 
the  findings  from  Dr.  Hirshfield’s  prior  AFOSR  physio-  sensor  experiments  mentioned  above  [1, 
6,  7,  14].  Although  the  model  has  implications  for  interpersonal  communications,  the  focus  of  the 
model  is  on  the  physiological  correlates  of  trust,  distrust,  and  suspicion  within  the  IT  domain.  The 
rest  of  this  section  describes  Figure  4  in  detail. 

Physiological  Correlates  of  Trust,  Distrust,  and  Suspicion 


KEY 


Figure  4:  Hirshfield’s  hypothesized  physiological  correlates  of  trust,  distrust,  and 

suspicion. 

At  a  high  level,  the  model  in  Figure  4  depicts  the  mental  states  that  a  computer  operator  transitions 
between  when  encountering  problems  (likely  caused  by  D5  techniques)  with  their  computer 
system.  These  computer  operators  spend  most  of  their  tune  in  long  term  user  states  of  trust  and 
distrust  (bottom  of  Fig  4).  While  the  literature  does  not  fully  agree  on  the  relationship  between 
trust  and  distrust,  this  model  views  trust  and  distrust  as  uni-dimensional  or,  at  the  very  least,  highly 
overlapping  multi-dimensional,  constructs.  In  practical  terms,  computer  operators  are  continually 
updating  their  levels  of  trust  based  on  interactions  with  their  environment. 

Many  operators  are  predisposed  to  have  a  high  level  of  trust  (or  distrust)  that  usually  serves  as  a 
lens  by  which  they  view  their  interactions  in  their  environment  (called  propensity  to  trust).  Most 
computer  operators  tend  to  be  cognitive  misers;  they  prefer  to  spend  their  time  focusing  their 
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cognitive  resources  on  the  task  at  hand,  rather  than  spending  effort  interpreting  interactions  from 
the  computer  system  or  an  external  agent  [7].  For  example,  operators  with  a  high  propensity  to 
trust  view  interactions  with  others  as  honest  and  straightforward,  enabling  them  to  adapt  a  truth 
heuristic  that  can  limit  workload  during  interactions  with  their  environment.  Viewing  the 
environment  through  a  predisposed  ‘high  trust’  lens  is  one  piece  of  information  built  into  people’s 
mental  model  (i.e.,  one’s  internal  model  of  how  the  world  around  them  works)  that  helps  them  to 
interact  with  their  environment  with  minimal  cognitive  load. 

When  something  occurs  that  violates  an  operator’s  mental  model  (such  as  a  program  crash,  or  an 
obviously  deceitful  email  allegedly  from  a  coworker)  that  operator’s  expectations  are  violated.  In 
that  case,  something  called  an  error  potential  (ErrP)  occurs  in  the  computer  user’s  brain  [6,  22, 
23],  This  can,  and  has  been,  detected  with  EEG,  even  when  the  violation  of  expectations  is 
extremely  subtle  [6].  Once  a  violation  of  expectations  has  occurred,  the  user  can  either  1)  attend 
to  that  item  and  become  suspicious  or  2)  return  to  the  task  at  hand. 

If  a  computer  user  becomes  suspicious,  he  experiences  a  “feeling  of  uncertainty  and  perceived 
malintent  about  the  underlying  information  or  actions  of  an  external  agent”  [20].  This  involves  an 
increase  in  negative  affect  as  well  as  an  increase  in  cognitive  load  as  he  generates  hypotheses  about 
the  source,  and  meaning  of,  the  discrepancy.  The  suspicious  state  ends  when  the  user  decides  either 
to  re-enter  a  trustful  state  (go  back  to  the  task  at  hand)  or  to  become  distrustful  (which  likely 
involves  an  action  such  as  making  a  call  to  the  IT  department,  or  running  antivirus  software). 

If  the  user  does  not  become  suspicious  (and  many  computer  users  experience  violations  in 
expectations  time  and  time  again  without  ever  becoming  suspicious),  then  that  user  will  remain  in 
his  long  term  state  residing  somewhere  within  the  trust/distrust  continuum.  It  is  worth  noting  that 
the  Bobko,  Barelka,  Hirshfield  theory  states  that  distrust  increases  likelihood  to  become  suspicious 
while  trust  buffers  suspicion  [20].  This  means  that  a  person  who  is  predisposed  to  view  the  world 
with  high  distrust  will  be  quicker  to  become  suspicious  than  will  his  highly-trusting  peer.  In  the 
case  where  the  user  experiences  a  violation  in  expectations  without  becoming  suspicious,  there 
will  likely  be  an  increase  in  negative  affect  (thought  not  always)  if  the  user  believes  the  discrepancy 
is  a  result  of  his  or  her  own  human  error.  Or,  the  user  may  attribute  the  discrepancy  to  problems 
with  the  computer  system  (i.e.,  “this  program  is  so  slow!”)  and  trust  may  be  lowered. 

As  stated  previously,  the  model  in  Figure  5  represents  the  culmination  of  all  of  Dr.  Hirshfield’s 
prior  theoretical  and  experimental  work  in  this  domain.  The  importance  of  this  model  is  that  it 
is  not  only  grounded  in  theoretical  work  from  research  on  trust,  distrust,  suspicion,  cognitive 
load,  and  cognitive  heuristics,  but  it  shows  how  transitions  between  states  of  trust  and 
suspicion  can  be  measured  in  experimental  settings  with  physiological  sensors.  This  model 
will  play  an  important  role  in  the  proposed  work  discussed  in  this  document. 

The  end  goal  of  measuring  the  effects  that  a  given  cyber  technique  has  on  computer  operators  has 
been  a  common  thread  throughout  these  research  efforts.  Table  1  provides  a  brief  overview  of  the 
specific  D5  techniques  that  have  been  tested  in  this  prior  work,  and  the  effects  of  the  D5  techniques 
as  measured  by  non-invasive  physiological  sensors. 
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Table  1:  Overview  of  cyber  techniques  that  have  been  tested  with  non-invasive  sensors  in 

Dr.  Hirshfield’s  prior  AFOSR  work. 


D5  Effect 

Measured  Effect  on  Operator 

Dropped  keystrokes 

Increased  WL  measured  w/  fNIRS[19]. 

Broken  links  (on  web) 

Error  potential  in  EEG  data[6]. 

Introduction  of  random  music  (on  web) 

Error  potential  in  EEG  data[6]. 

Introduction  of  sudden  animation  (on  web) 

Error  potential  in  EEG  data[6]. 

Improper  symbol/metaphor  mapping  (on  web) 

Error  potential  in  EEG  data[6]. 

Pop-ups 

Increased  WL  measured  with  fNIRS  [19], 

Slow  internet 

Increased  WL  and  increased  ‘frustration’ 
measured  with  fNIRS[14]. 

System  crash 

Increased  WL  and  increased  ‘distress’ 
measured  with  fNIRS[14]. 
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